Do minidump files contain the timestamp of the crash?

Question

The MiscInfoStream in a minidump file contains the process create time. I'd like to find out how long the process has been running for before the crash. Does a minidump file contain the exception timestamp anywhere?

WinDbg on this dump file displays the following, which implies that it's in there somewhere...

Debug session time: Tue Dec 29 15:49:20.000 2009 (GMT+0)
System Uptime: not available
Process Uptime: 0 days 0:33:03.000

(DumpChk displays the same information, at the end of the list of streams)

Note that today's Mar 15, so this is almost certainly the timestamp of the crash. I'd like a programmatic way to retrieve that value and the "Process Uptime" value.

I found the MINIDUMP_MISC_INFO_3 structure, which contains some timezone information, but it doesn't seem to contain the exception time.

Some dump files appear to have a ThreadInfoListStream, which contains the timestamps for each thread in the process, but this isn't included in the minidumps that I've seen.

Answer 1

I don't think the time of the exception is stored anywhere in the minidump file. The exception structure certainly does not contain this info: http://msdn.microsoft.com/en-us/library/ms680367%28VS.85%29.aspx

The misc info struct does contain the process start time, but not the exception time: http://msdn.microsoft.com/en-us/library/ms680389%28VS.85%29.aspx

You can see all the possible contents of a minidump here: http://msdn.microsoft.com/en-us/library/ms680394%28v=VS.85%29.aspx